CVE-2020-6070 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
F2Fs-Tools Project	F2Fs-Tools	1.12.0
Fedoraproject	Fedora	33

Related Weaknesses (CWE)

CWE-131

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
https://talosintelligence.com/vulnerability_reports/TALOS-2020-0988ExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
https://talosintelligence.com/vulnerability_reports/TALOS-2020-0988ExploitThird Party Advisory

FAQ

What is CVE-2020-6070?

CVE-2020-6070 is a vulnerability with a CVSS score of 7.8 (HIGH). An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations...

How severe is CVE-2020-6070?

CVE-2020-6070 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-6070?

Check the references section above for vendor advisories and patch information. Affected products include: F2Fs-Tools Project F2Fs-Tools, Fedoraproject Fedora.